Last updated: 6th October 2026
This Privacy Policy explains how Gusto AI L.L.C-FZ, Dubai, United Arab Emirates (“Gusto AI”, “we”, “us”) collects, uses and protects personal data of users (“Users”, “you”) of the Gusto AI mobile application and related services (the “App”).
This policy is governed by the laws of the United Arab Emirates, in particular the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
Controller: Gusto AI L.L.C-FZ, Dubai, United Arab Emirates.
Email: privacy@gusto-ai.com
Gusto AI acts as the Data Controller for personal data processed through the App.
This Privacy Policy applies to:
It does not apply to restaurant partner portals or third-party platforms.
We may collect the following categories of data:
If you connect a third-party wearable account (currently WHOOP or Oura), we receive, for your account only:
We treat this as sensitive personal data. We receive it only after you have explicitly connected the account and only for the categories you approved on your provider’s consent screen. You can disconnect at any time in the App; we then stop receiving data and delete what we hold (Section 8).
We do not receive your location, messages, contacts, payment data or medical records from your wearable provider.
We do not collect medical records, diagnoses or genetic data. We do collect health and wellness data from connected wearable devices, but only if you choose to connect such a device — see Section 3.F.
We process personal data to:
Some recommendations, and the explanations shown with them, are generated with the assistance of a third-party AI service. This never includes health data (see Section 3.F).
Health data is used only for adjusting recommendations as described above. We convert the values we receive into coarse bands — for example sleep “short / normal / long”, recovery “low / medium / high” — and base recommendations on those bands using our own rule-based logic.
We do not send health data to any third-party artificial intelligence or large language model provider, and we do not use health data to train, fine-tune, evaluate or benchmark any AI model.
No medical advice. Gusto AI is not a medical device. Recommendations are meal suggestions, not medical, dietary-therapeutic or other professional advice. They are not suitable for diagnosing, treating or preventing any condition. Consult a qualified professional for medical questions.
Under UAE PDPL, we rely on:
Where required, consent can be withdrawn at any time.
Health data. We process health data from connected wearables solely on the basis of your separate, explicit consent, given when you connect the device. This consent is independent of your account registration and of your acceptance of our Terms. You may withdraw it at any time by disconnecting the device in the App, without affecting your use of the rest of the App.
We may share data with:
We do not sell user data. All third parties are contractually required to protect personal data.
Health data from connected wearables is never shared with restaurant partners, delivery partners, payment providers, advertising networks or AI providers. It is never sold or licensed. It is processed only by Gusto AI and by our cloud hosting provider for the purpose of operating the App.
Personal data may be processed outside the UAE (e.g. cloud infrastructure). We ensure transfers comply with UAE PDPL requirements and appropriate safeguards are in place.
We retain personal data as long as your account is active, as necessary to provide services, or as required by law. Data is deleted or anonymised when no longer required.
Health data. If you disconnect a wearable, we delete the stored access credentials immediately and the derived health data within 72 hours. If you request deletion of your health data, we delete it within 72 hours and retain no copies. Deleting your Gusto AI account deletes all health data with it.
In accordance with UAE PDPL, you may request to:
Requests can be made via privacy@gusto-ai.com.
We implement appropriate safeguards, including encryption of sensitive data, secure authentication, access controls, monitoring and incident response procedures.
Access credentials for connected wearables are encrypted at rest with AES-256-GCM, and health data is stored separately from your account and order data.
The App may use essential cookies/SDKs and analytics tools. You can control permissions through your device or App settings.
The App is not intended for users under the age of 18. We do not knowingly collect data from minors.
Where you connect a wearable, the data originates from your account with that provider, and their own privacy policy governs how they process it:
Connecting or disconnecting your Gusto AI account does not change your relationship with these providers. Revoking access in your provider’s own account settings also stops data reaching us.
For privacy-related questions or requests: privacy@gusto-ai.com
© 2026 Gusto AI. Legal Entity: Gusto AI L.L.C-FZ, Dubai, U.A.E.